Cordyceps Supply Chain Flaw Impacting Code Repositories at thousands of Organizations

Cybersecuritynews •Tushar Subhra Dutta • June 23, 2026

A newly discovered supply chain flaw is putting thousands of organizations at serious risk. Named Cordyceps after the parasitic fungus known for taking over its hosts, this critical vulnerability quietly burrows into software development pipelines and gives attackers full control of code repositories at some of the biggest companies in the world. The flaw targets […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cordyceps Vulnerability Exposes Thousands of Code Repositories to Attacks A newly identified supply chain vulnerability named 'Cordyceps' affects CI/CD workflows across major platforms, allowing unauthenticated attackers to exploit Git-based repositories. Novee's research flagged 654 vulnerable repositories, with over 300 confirmed as fully exploitable. The vulnerability arises from insecure workflow compositions, enabling command injection, credential theft, and privilege escalation. Affected systems include Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris, Cloudflare's Workers SDK, and the Python Software Foundation's Black project. Major companies have confirmed the vulnerability and implemented fixes, but the potential impact could extend to millions of repositories. The flaw's systemic nature highlights the need for enhanced security measures in CI/CD configurations. 13 sources 72

Extracted Entities

Cordyceps Supply Chain Flaw Impacting Code Repositories at thousands of Organizations

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Vulnerabilities (1)